Skip to the content
The Update Bureau
.NET Framework 3.5 / 4.8.1 .NET Framework 3.5 / 4.8.1 Security update
Patch Tuesday

KB5082420

KB5082420: Cumulative update for .NET Framework, versions 3.5 and 4.8.1, on Windows 11 24H2, April 2026. Runtime denial-of-service flaw addressed; app-container service fixed

In short

The update addresses six vulnerabilities, including a critical denial-of-service flaw, and addresses a problem running a Windows communication service in an app's restricted environment.

Does it affect you? Applies to: Devices running Windows 11, version 24H2, with .NET Framework 3.5 or 4.8.1 installed.

File version
2.0.50727.9181 · 4.8.9332.0
Security
6 fixed · 1 critical
Restart
Required

What changes

Fixes 7 changes

.NET Framework

6 items

For: devices with .NET Framework 3.5 or 4.8.1

  • A flaw that could allow code to run remotely is addressed.1
    Addresses the remote code execution vulnerability CVE-2026-32178.
  • A flaw that could disrupt service availability is addressed.2
    Addresses the denial-of-service vulnerability CVE-2026-32203.
  • A flaw that could disrupt service availability is addressed.3
    Addresses the denial-of-service vulnerability CVE-2026-32226.
  • A flaw that could disrupt service availability is addressed.4
    Addresses the denial-of-service vulnerability CVE-2026-23666, rated Critical.
  • A flaw that could bypass a security feature is addressed.5
    Addresses the security feature bypass vulnerability CVE-2026-26171.
  • A flaw that could expose information is addressed.6
    Addresses the information disclosure vulnerability CVE-2026-33116.

WCF

Verified in package

For: unknown

  • A problem that could stop a Windows communication service from running in an app's restricted environment is addressed.7
    Addresses an issue running a WCF NamedPipe service inside a Win32 app container on Windows 11 or Windows Server 2025.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-04-14
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5074831, KB5066131, KB5064401, KB5056579
+6 earlier KB5054979, KB5050577, KB5049622, KB5048162, KB5045934, KB5044030
Replaced by
KB5087054
VersionFile versionChannel
3.5 2.0.50727.9181 General availability
4.8.1 4.8.9332.0 General availability

Security

6 vulnerabilities fixed
1 critical 2 important 3 not rated
VulnerabilitySeverityCVSS
CVE-2026-23666
.NET Framework Denial of Service Vulnerability
 Critical 7.5
CVE-2026-33116
.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability
 Important 7.5
CVE-2026-32226
.NET Framework Denial of Service Vulnerability
 Important 5.9
CVE-2026-26171
.NET Denial of Service Vulnerability
 Not rated —
CVE-2026-32178
.NET Spoofing Vulnerability
 Not rated —
CVE-2026-32203
.NET and Visual Studio Denial of Service Vulnerability
 Not rated —

Updated components

61 files changed since the previous update for the same versions.

Top changed componentsFiles
WCF14
.NET runtime (CLR)12
Windows Forms2

Verified in package: changed files confirm WCF.

Sources

Updated
Cited passages from Microsoft's official notes (7)
  1. 1. This security update addresses a remote code execution vulnerability detailed in CVE-2026-32178. support.microsoft.com
  2. 2. This security update addresses a denial-of-service vulnerability detailed in CVE-2026-32203. support.microsoft.com
  3. 3. This security update addresses a denial-of-service vulnerability detailed in CVE-2026-32226. support.microsoft.com
  4. 4. This security update addresses a denial-of-service vulnerability detailed in CVE-2026-23666. support.microsoft.com
  5. 5. This security update addresses a security feature bypass vulnerability detailed in CVE-2026-26171. support.microsoft.com
  6. 6. This security update addresses an information disclosure vulnerability detailed in CVE-2026-33116. support.microsoft.com
  7. 7. Addresses an issue with running a WCF NamedPipe service inside a Win32 app container when running on Windows 11 or Windows Server 2025. support.microsoft.com
Checked automatically: 7 of 8 checks passed, 7 quoted passages · compared with Microsoft's page on Sep 25, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake